`sed` works one line at a time,
so the allowlist never removed newlines inside `NVM_AUTH_HEADER`.
A `Basic` credential built with GNU `base64`,
which wraps its output at 76 columns,
therefore reached the downloader split across several lines,
and authentication failed (wget rejects such a header outright).
Filter with `tr -cd` instead,
using the same set of allowed characters,
so CR and LF are deleted like any other disallowed character and a wrapped credential is joined back into one line
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-W1E9TAK3; the scanner correctly classified it as not a vulnerability.
Jordan Harband
d8b39c746e